CVE-2026-85572: Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure

Q: Which users can exploit this issue?

Any authenticated WordPress user can exploit it, including users with only the Subscriber role. The affected user does not need to be enrolled in the course whose lesson discussion content they access.

Q: What information could be exposed?

Lesson discussion comments from courses the user is not authorized to access may be disclosed. This includes comments that are awaiting moderation.

Q: Which plugin versions are affected?

Tutor LMS versions before 4.0.8 are affected. Version 4.0.8 is not identified as affected by the provided information.

Published Sep 16, 2026

Updated

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.

Affected Software

1 affected component

Tutor LMS WordPress plugin<4.0.8

Event History

Sep 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated WordPress user can exploit it, including users with only the Subscriber role. The affected user does not need to be enrolled in the course whose lesson discussion content they access.

What information could be exposed?

Lesson discussion comments from courses the user is not authorized to access may be disclosed. This includes comments that are awaiting moderation.

Which plugin versions are affected?

Tutor LMS versions before 4.0.8 are affected. Version 4.0.8 is not identified as affected by the provided information.